From 023d15b50fc0f862bd1b1b9fee9011ea03c27780 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 12 Aug 2024 15:26:49 -0400 Subject: [PATCH 01/44] IoT: Update rawhide for F-42 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-41.repo => fedora-42.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-41.repo => fedora-42.repo (61%) diff --git a/config.ini b/config.ini index 0b65ffb..f7e27f5 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f41 +release = f42 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-41.repo b/fedora-42.repo similarity index 61% rename from fedora-41.repo rename to fedora-42.repo index 1412aca..f9343b8 100644 --- a/fedora-41.repo +++ b/fedora-42.repo @@ -1,12 +1,12 @@ -[fedora-41] -name=Fedora 41 - $basearch +[fedora-42] +name=Fedora 42 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/41/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-41&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/42/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-42&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-41-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-42-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 25d3bdd..b665f4b 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -6,8 +6,8 @@ ima: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '41' -mutate-os-release: '41' +automatic_version_prefix: '42' +mutate-os-release: '42' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 51c17ad..f765bfe 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-41 +- fedora-42 From 16c554471c0bf12185450ba146af83fdf9a42ad8 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 12 Aug 2024 15:44:55 -0400 Subject: [PATCH 02/44] Setup for F-41 branched Signed-off-by: Paul Whalen --- config.ini | 4 ++-- fedora-iot-base.yaml | 2 +- fedora-iot-updates-stable.yaml | 2 +- fedora-iot-updates-testing.yaml | 2 +- fedora-iot.yaml | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/config.ini b/config.ini index 0b65ffb..4e7d4a9 100644 --- a/config.ini +++ b/config.ini @@ -11,8 +11,8 @@ tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 release = f41 -ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s -yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ +ref = %(os_name)s/devel/%(arch)s/%(tree_name)s +yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/41/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides lorax_include_packages = fedora-productimg-iot docker_os_name = fedora diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 25d3bdd..70f2ac9 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,5 +1,5 @@ include: bootupd.yaml -ref: fedora/rawhide/${basearch}/iot +ref: fedora/devel/${basearch}/iot repos: [] selinux: true ima: true diff --git a/fedora-iot-updates-stable.yaml b/fedora-iot-updates-stable.yaml index 263bd4b..446cfb9 100644 --- a/fedora-iot-updates-stable.yaml +++ b/fedora-iot-updates-stable.yaml @@ -1,2 +1,2 @@ include: fedora-iot-base.yaml -ref: fedora/rawhide/${basearch}/updates/iot +ref: fedora/devel/${basearch}/updates/iot diff --git a/fedora-iot-updates-testing.yaml b/fedora-iot-updates-testing.yaml index c6eb5a5..596961a 100644 --- a/fedora-iot-updates-testing.yaml +++ b/fedora-iot-updates-testing.yaml @@ -1,2 +1,2 @@ include: fedora-iot-base.yaml -ref: fedora/rawhide/${basearch}/testing/iot +ref: fedora/devel/${basearch}/testing/iot diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 51c17ad..bcd18ca 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,4 @@ include: fedora-iot-base.yaml -ref: fedora/rawhide/${basearch}/iot +ref: fedora/devel/${basearch}/iot repos: - fedora-41 From 1a898a733753e9700e305e41ea218456780efe13 Mon Sep 17 00:00:00 2001 From: Micah Abbott Date: Wed, 28 Aug 2024 13:54:39 -0400 Subject: [PATCH 03/44] bootupd: add some contextual comments Signed-off-by: Micah Abbott --- bootupd.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/bootupd.yaml b/bootupd.yaml index 949f504..3328d41 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -1,3 +1,7 @@ +# KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml +# See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml +# +#Integration with https://github.com/coreos/bootupd packages: - bootupd From ad5623c52a7d45aa13e7805d779ab385b4e7a279 Mon Sep 17 00:00:00 2001 From: Micah Abbott Date: Wed, 28 Aug 2024 13:54:39 -0400 Subject: [PATCH 04/44] F41: bootupd: add some contextual comments Cherry-picked 1a898a7 Signed-off-by: Micah Abbott --- bootupd.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/bootupd.yaml b/bootupd.yaml index 949f504..3328d41 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -1,3 +1,7 @@ +# KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml +# See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml +# +#Integration with https://github.com/coreos/bootupd packages: - bootupd From 36ab3daaf041fe8f822fd639a3d31a093939cc93 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 3 Sep 2024 09:38:53 -0400 Subject: [PATCH 05/44] fedora-iot-base: Add workaround for issue with newer GRUB2 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 5 ++++- grub2-workaround.yaml | 22 ++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) create mode 100644 grub2-workaround.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index b665f4b..a7afbd1 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,4 +1,7 @@ -include: bootupd.yaml +include: + - bootupd.yaml + # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 + - grub2-workaround.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true diff --git a/grub2-workaround.yaml b/grub2-workaround.yaml new file mode 100644 index 0000000..3b58a9e --- /dev/null +++ b/grub2-workaround.yaml @@ -0,0 +1,22 @@ +# Temporarily disable new GRUB2 config options until we can ensure that we +# have an updated bootloader via bootupd. +# This is workaround for: https://bugzilla.redhat.com/show_bug.cgi?id=2305291 +# See: https://github.com/fedora-silverblue/issue-tracker/issues/587 +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + # Completely disable this module + sed -i '2i exit 0' /etc/grub.d/25_bli + + # Skip check that was not performed in previous Fedora versions + sed -i '/fwsetup --is-supported/d' /etc/grub.d/30_uefi-firmware + sed -i '/\tif/d' /etc/grub.d/30_uefi-firmware + sed -i '/\tfi/d' /etc/grub.d/30_uefi-firmware + sed -i 's/\t\t/\t/' /etc/grub.d/30_uefi-firmware + + # Verify that the content matches what we expect the file to look like. + # This will fail the build here instead of breaking users' systems. + hash="5a77a16c6a94e664e2e96a870f4531b9a0b4e63be1f46751d01e774629a8c84b" + echo "$hash /etc/grub.d/30_uefi-firmware" | sha256sum -c From 0aa593407dfa3e8ef60729efa97af978d051f6ae Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 3 Sep 2024 09:47:45 -0400 Subject: [PATCH 06/44] fedora-iot-base: Add workaround for issue with newer GRUB2 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 5 ++++- grub2-workaround.yaml | 22 ++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) create mode 100644 grub2-workaround.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 70f2ac9..54026b0 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,4 +1,7 @@ -include: bootupd.yaml +include: + - bootupd.yaml + # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 + - grub2-workaround.yaml ref: fedora/devel/${basearch}/iot repos: [] selinux: true diff --git a/grub2-workaround.yaml b/grub2-workaround.yaml new file mode 100644 index 0000000..3b58a9e --- /dev/null +++ b/grub2-workaround.yaml @@ -0,0 +1,22 @@ +# Temporarily disable new GRUB2 config options until we can ensure that we +# have an updated bootloader via bootupd. +# This is workaround for: https://bugzilla.redhat.com/show_bug.cgi?id=2305291 +# See: https://github.com/fedora-silverblue/issue-tracker/issues/587 +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + # Completely disable this module + sed -i '2i exit 0' /etc/grub.d/25_bli + + # Skip check that was not performed in previous Fedora versions + sed -i '/fwsetup --is-supported/d' /etc/grub.d/30_uefi-firmware + sed -i '/\tif/d' /etc/grub.d/30_uefi-firmware + sed -i '/\tfi/d' /etc/grub.d/30_uefi-firmware + sed -i 's/\t\t/\t/' /etc/grub.d/30_uefi-firmware + + # Verify that the content matches what we expect the file to look like. + # This will fail the build here instead of breaking users' systems. + hash="5a77a16c6a94e664e2e96a870f4531b9a0b4e63be1f46751d01e774629a8c84b" + echo "$hash /etc/grub.d/30_uefi-firmware" | sha256sum -c From 176b0add790ece0b16b41337569b9170b0514117 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 20 Sep 2024 15:28:56 +0100 Subject: [PATCH 07/44] drop dnsmasq Not sure why it was included, I suspect it was once used for container networking. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index a7afbd1..4c64cd1 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -99,7 +99,6 @@ packages: - dbus-parsec - dnf5 - dnf5-plugins -- dnsmasq - dosfstools - dracut-config-generic - dracut-network From 7fad539f14b45a86c55646f7bae468a7146fdac1 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 20 Sep 2024 15:28:56 +0100 Subject: [PATCH 08/44] drop dnsmasq Not sure why it was included, I suspect it was once used for container networking. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 54026b0..23dc294 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -99,7 +99,6 @@ packages: - dbus-parsec - dnf5 - dnf5-plugins -- dnsmasq - dosfstools - dracut-config-generic - dracut-network From 597796c53f30950d9edaa85b6d6a07ee1a829d5c Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 25 Sep 2024 08:57:05 -0400 Subject: [PATCH 09/44] Add iot base bootc image Signed-off-by: Paul Whalen --- fedora-bootc-base/autoupdates.yaml | 9 -- fedora-bootc-base/bootc-config.yaml | 10 --- fedora-bootc-base/bootc.yaml | 4 + fedora-bootc-base/bootupd.yaml | 2 +- fedora-bootc-base/initramfs.yaml | 12 ++- fedora-bootc-base/iot.yaml | 100 +++++++++++++++++++++ fedora-bootc-base/manifest.yaml | 14 +-- fedora-bootc.yaml => fedora-iot-bootc.yaml | 6 +- 8 files changed, 121 insertions(+), 36 deletions(-) delete mode 100644 fedora-bootc-base/autoupdates.yaml create mode 100644 fedora-bootc-base/iot.yaml rename fedora-bootc.yaml => fedora-iot-bootc.yaml (61%) diff --git a/fedora-bootc-base/autoupdates.yaml b/fedora-bootc-base/autoupdates.yaml deleted file mode 100644 index a416699..0000000 --- a/fedora-bootc-base/autoupdates.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# Enable automatic updates by default -postprocess: - - | - #!/usr/bin/env bash - set -euo pipefail - target=/usr/lib/systemd/system/default.target.wants - mkdir -p $target - set -x - ln -s ../bootc-fetch-apply-updates.timer $target diff --git a/fedora-bootc-base/bootc-config.yaml b/fedora-bootc-base/bootc-config.yaml index 4d4b24e..e69de29 100644 --- a/fedora-bootc-base/bootc-config.yaml +++ b/fedora-bootc-base/bootc-config.yaml @@ -1,10 +0,0 @@ -# Configuration for bootc -postprocess: - # ext4 is our default filesystem in iot - - | - #!/usr/bin/env bash - mkdir -p /usr/lib/bootc/install/ - cat > /usr/lib/bootc/install/20-default-root.toml << EOF - [install] - root-fs-type = "ext4" - EOF diff --git a/fedora-bootc-base/bootc.yaml b/fedora-bootc-base/bootc.yaml index a862e6c..d44ee08 100644 --- a/fedora-bootc-base/bootc.yaml +++ b/fedora-bootc-base/bootc.yaml @@ -2,6 +2,10 @@ packages: - systemd - bootc + # bootc pulls in podman, which pulls in containers-common, which wants + # `iptables`. Currently that pulls in iptables-legacy. Let's explicitly name + # iptables-nft instead to satisfy it. + - iptables-nft # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk - gdisk xfsprogs e2fsprogs dosfstools diff --git a/fedora-bootc-base/bootupd.yaml b/fedora-bootc-base/bootupd.yaml index 7d3ebf3..cc83d20 100644 --- a/fedora-bootc-base/bootupd.yaml +++ b/fedora-bootc-base/bootupd.yaml @@ -13,7 +13,7 @@ packages-s390x: # provided by s390utils-base, but soon will be -core too. - /usr/sbin/zipl packages-x86_64: - - grub2 grub2-efi-x64 efibootmgr shim + - grub2-efi-x64 efibootmgr shim - microcode_ctl conditional-include: diff --git a/fedora-bootc-base/initramfs.yaml b/fedora-bootc-base/initramfs.yaml index de65333..fe4bbeb 100644 --- a/fedora-bootc-base/initramfs.yaml +++ b/fedora-bootc-base/initramfs.yaml @@ -6,13 +6,19 @@ postprocess: cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF' # We want a generic image; hostonly makes no sense as part of a server side build hostonly=no - dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " + add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " EOF cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF' # Extra modules that we want by default that are known to exist in the kernel - dracutmodules+=" virtiofs " + add_dracutmodules+=" virtiofs " EOF cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF' # We want this for systemd-cryptsetup tpm2 locking - dracutmodules+=" tpm2-tss " + add_dracutmodules+=" tpm2-tss " + EOF + cat > /usr/lib/dracut/dracut.conf.d/59-altfiles.conf << 'EOF' + # https://issues.redhat.com/browse/RHEL-49590 + # On image mode systems we use nss-altfiles for passwd and group, + # this makes sure dracut uses them which also fixes kdump writing to NFS. + install_items+=" /usr/lib/passwd /usr/lib/group " EOF diff --git a/fedora-bootc-base/iot.yaml b/fedora-bootc-base/iot.yaml new file mode 100644 index 0000000..611ff9a --- /dev/null +++ b/fedora-bootc-base/iot.yaml @@ -0,0 +1,100 @@ +# Fedora IoT specific packages +packages: + - fedora-release-iot + - aardvark-dns + - atheros-firmware + - attr + - authselect + - basesystem + - bash + - bash-completion + - brcmfmac-firmware + - chrony + - clevis + - clevis-dracut + - clevis-luks + - clevis-pin-tpm2 + - containernetworking-plugins + - coreutils + - cracklib-dicts + - criu + - criu-libs + - cryptsetup + - curl + - dbus-parsec + - dnf5-plugins + - dracut-config-generic + - dracut-network + - efibootmgr + - fdo-client + - firewalld + - fwupd + - fwupd-efi + - fwupd-plugin-modem-manager + - fwupd-plugin-uefi-capsule-data + - glibc + - glibc-minimal-langpack + - gnupg2 + - greenboot + - greenboot-default-health-checks + - gzip + - hostname + - ignition + - ima-evm-utils + - iproute + - iputils + - iwd + - iwlwifi-mvm-firmware + - kernel-tools + - keyutils + - less + - libsss_sudo + - linux-firmware + - lvm2 + - netavark + - NetworkManager + - NetworkManager-wifi + - NetworkManager-wwan + - nss-altfiles + - openssl + - openssh-clients + - openssh-server + - passt + - passt-selinux + - parsec + - pinentry + - podman + - policycoreutils + - policycoreutils-python-utils + - polkit + - procps-ng + - realtek-firmware + - rootfiles + - rpm + - screen + - setools-console + - setup + - shadow-utils + - skopeo + - slirp4netns + - sssd-client + - sudo + - systemd-resolved + - tar + - tmux + - tpm2-pkcs11 + - traceroute + - usbguard + - util-linux + - vim-minimal + - wpa_supplicant + - wireless-regdb + - xz + - zezere-ignition + - zram-generator + - zram-generator-defaults +packages-aarch64: + - arm-image-installer + - bcm283x-firmware + - optee_client + - uboot-images-armv8 diff --git a/fedora-bootc-base/manifest.yaml b/fedora-bootc-base/manifest.yaml index 007f6d7..9a21ff3 100644 --- a/fedora-bootc-base/manifest.yaml +++ b/fedora-bootc-base/manifest.yaml @@ -44,19 +44,18 @@ remove-from-packages: # We don't want auto-generated mount units. See also # https://github.com/systemd/systemd/issues/13099 - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator] - # Drop some buggy sysusers fragments which do not match static IDs allocation: - # https://bugzilla.redhat.com/show_bug.cgi?id=2105177 - - [dbus-common, /usr/lib/sysusers.d/dbus.conf] include: - bootc.yaml + - bootupd.yaml - ostree.yaml - - bootc-config.yaml - initramfs.yaml - - autoupdates.yaml - basic-fixes.yaml + - iot.yaml packages: + # needed for building derived container images + - dnf5 # Even in tier-0, we have this. If you don't want SELinux today, you'll need # to build a custom image. - selinux-policy-targeted @@ -64,8 +63,3 @@ packages: - container-selinux # Needed for tpm2 bound luks - tpm2-tools - -# See https://github.com/coreos/bootupd -arch-include: - x86_64: bootupd.yaml - aarch64: bootupd.yaml diff --git a/fedora-bootc.yaml b/fedora-iot-bootc.yaml similarity index 61% rename from fedora-bootc.yaml rename to fedora-iot-bootc.yaml index 7067275..6ae5882 100644 --- a/fedora-bootc.yaml +++ b/fedora-iot-bootc.yaml @@ -1,13 +1,13 @@ releasever: rawhide variables: - distro: "fedora" + distro: "fedora-iot" repos: - fedora-rawhide metadata: - name: fedora-bootc - summary: Fedora base bootc image + name: fedora-iot-bootc-base + summary: Fedora IoT bootc base image include: - fedora-bootc-base/manifest.yaml From 750a452d9ddf2466a43f85214a02a7cff10b60ba Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 27 Sep 2024 16:51:54 -0400 Subject: [PATCH 10/44] F41: Add iot base bootc image Signed-off-by: Paul Whalen --- fedora-bootc-base/autoupdates.yaml | 9 --- fedora-bootc-base/bootc-config.yaml | 10 --- fedora-bootc-base/bootupd.yaml | 2 +- fedora-bootc-base/initramfs.yaml | 6 +- fedora-bootc-base/iot.yaml | 113 ++++++++++++++++++++++++++++ fedora-bootc-base/manifest.yaml | 11 +-- fedora-bootc.yaml | 15 ---- fedora-iot-bootc.yaml | 15 ++++ 8 files changed, 136 insertions(+), 45 deletions(-) delete mode 100644 fedora-bootc-base/autoupdates.yaml create mode 100644 fedora-bootc-base/iot.yaml delete mode 100644 fedora-bootc.yaml create mode 100644 fedora-iot-bootc.yaml diff --git a/fedora-bootc-base/autoupdates.yaml b/fedora-bootc-base/autoupdates.yaml deleted file mode 100644 index a416699..0000000 --- a/fedora-bootc-base/autoupdates.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# Enable automatic updates by default -postprocess: - - | - #!/usr/bin/env bash - set -euo pipefail - target=/usr/lib/systemd/system/default.target.wants - mkdir -p $target - set -x - ln -s ../bootc-fetch-apply-updates.timer $target diff --git a/fedora-bootc-base/bootc-config.yaml b/fedora-bootc-base/bootc-config.yaml index 4d4b24e..e69de29 100644 --- a/fedora-bootc-base/bootc-config.yaml +++ b/fedora-bootc-base/bootc-config.yaml @@ -1,10 +0,0 @@ -# Configuration for bootc -postprocess: - # ext4 is our default filesystem in iot - - | - #!/usr/bin/env bash - mkdir -p /usr/lib/bootc/install/ - cat > /usr/lib/bootc/install/20-default-root.toml << EOF - [install] - root-fs-type = "ext4" - EOF diff --git a/fedora-bootc-base/bootupd.yaml b/fedora-bootc-base/bootupd.yaml index 7d3ebf3..cc83d20 100644 --- a/fedora-bootc-base/bootupd.yaml +++ b/fedora-bootc-base/bootupd.yaml @@ -13,7 +13,7 @@ packages-s390x: # provided by s390utils-base, but soon will be -core too. - /usr/sbin/zipl packages-x86_64: - - grub2 grub2-efi-x64 efibootmgr shim + - grub2-efi-x64 efibootmgr shim - microcode_ctl conditional-include: diff --git a/fedora-bootc-base/initramfs.yaml b/fedora-bootc-base/initramfs.yaml index de65333..95146e2 100644 --- a/fedora-bootc-base/initramfs.yaml +++ b/fedora-bootc-base/initramfs.yaml @@ -6,13 +6,13 @@ postprocess: cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF' # We want a generic image; hostonly makes no sense as part of a server side build hostonly=no - dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " + add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " EOF cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF' # Extra modules that we want by default that are known to exist in the kernel - dracutmodules+=" virtiofs " + add_dracutmodules+=" virtiofs " EOF cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF' # We want this for systemd-cryptsetup tpm2 locking - dracutmodules+=" tpm2-tss " + add_dracutmodules+=" systemd-cryptsetup tpm2-tss " EOF diff --git a/fedora-bootc-base/iot.yaml b/fedora-bootc-base/iot.yaml new file mode 100644 index 0000000..2c02ca6 --- /dev/null +++ b/fedora-bootc-base/iot.yaml @@ -0,0 +1,113 @@ +# Fedora IoT specific packages +packages: + - fedora-release-iot + - aardvark-dns + - atheros-firmware + - attr + - authselect + - basesystem + - bash + - bash-completion + - bootc + - brcmfmac-firmware + - chrony + - clevis + - clevis-dracut + - clevis-luks + - clevis-pin-tpm2 + - container-selinux + - containernetworking-plugins + - coreutils + - cracklib-dicts + - criu + - criu-libs + - cryptsetup + - curl + - dbus-parsec + - dnf5-plugins + - dosfstools + - dracut-config-generic + - dracut-network + - e2fsprogs + - efibootmgr + - fdo-client + - firewalld + - fwupd + - fwupd-efi + - fwupd-plugin-modem-manager + - fwupd-plugin-uefi-capsule-data + - glibc + - glibc-minimal-langpack + - gnupg2 + - greenboot + - greenboot-default-health-checks + - gzip + - hostname + - ignition + - ima-evm-utils + - iproute + - iputils + - iwd + - iwlwifi-mvm-firmware + - kernel-tools + - keyutils + - less + - libsss_sudo + - linux-firmware + - lvm2 + - netavark + - NetworkManager + - NetworkManager-wifi + - NetworkManager-wwan + - nss-altfiles + - openssl + - openssh-clients + - openssh-server + - passt + - passt-selinux + - parsec + - pinentry + - podman + - policycoreutils + - policycoreutils-python-utils + - polkit + - procps-ng + - realtek-firmware + - rootfiles + - rpm + - screen + - selinux-policy-targeted + - setools-console + - setup + - shadow-utils + - skopeo + - slirp4netns + - sssd-client + - sudo + - systemd + - systemd-resolved + - tar + - tmux + - tpm2-pkcs11 + - traceroute + - usbguard + - util-linux + - vim-minimal + - wpa_supplicant + - wireless-regdb + - xfsprogs + - xz + - zezere-ignition + - zram-generator + - zram-generator-defaults +packages-aarch64: + - arm-image-installer + - bcm283x-firmware + - grub2-efi-aa64 + - optee_client + - shim-aa64 + - uboot-images-armv8 +packages-x86_64: + - grub2-efi-x64 + - microcode_ctl + - shim-x64 diff --git a/fedora-bootc-base/manifest.yaml b/fedora-bootc-base/manifest.yaml index 007f6d7..f836419 100644 --- a/fedora-bootc-base/manifest.yaml +++ b/fedora-bootc-base/manifest.yaml @@ -50,13 +50,15 @@ remove-from-packages: include: - bootc.yaml + - bootupd.yaml - ostree.yaml - - bootc-config.yaml - initramfs.yaml - - autoupdates.yaml - basic-fixes.yaml + - iot.yaml packages: + # needed for building derived container images + - dnf5 # Even in tier-0, we have this. If you don't want SELinux today, you'll need # to build a custom image. - selinux-policy-targeted @@ -64,8 +66,3 @@ packages: - container-selinux # Needed for tpm2 bound luks - tpm2-tools - -# See https://github.com/coreos/bootupd -arch-include: - x86_64: bootupd.yaml - aarch64: bootupd.yaml diff --git a/fedora-bootc.yaml b/fedora-bootc.yaml deleted file mode 100644 index 7067275..0000000 --- a/fedora-bootc.yaml +++ /dev/null @@ -1,15 +0,0 @@ -releasever: rawhide -variables: - distro: "fedora" - -repos: - - fedora-rawhide - -metadata: - name: fedora-bootc - summary: Fedora base bootc image - -include: - - fedora-bootc-base/manifest.yaml - - fedora-bootc-base/kernel.yaml - diff --git a/fedora-iot-bootc.yaml b/fedora-iot-bootc.yaml new file mode 100644 index 0000000..475c0ca --- /dev/null +++ b/fedora-iot-bootc.yaml @@ -0,0 +1,15 @@ +releasever: 41 +variables: + distro: "fedora-iot" + +repos: + - fedora-41 + +metadata: + name: fedora-iot-bootc-base + summary: Fedora IoT bootc base image + +include: + - fedora-bootc-base/manifest.yaml + - fedora-bootc-base/kernel.yaml + From 52884d20e4a467892bb4c723c3cfa331b39e21bd Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 25 Oct 2024 10:58:21 -0400 Subject: [PATCH 11/44] F41: Update for final Signed-off-by: Paul Whalen --- config.ini | 4 ++-- fedora-iot-base.yaml | 2 +- fedora-iot-updates-stable.yaml | 2 +- fedora-iot-updates-testing.yaml | 2 +- fedora-iot.yaml | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/config.ini b/config.ini index 4e7d4a9..d4c4586 100644 --- a/config.ini +++ b/config.ini @@ -11,8 +11,8 @@ tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 release = f41 -ref = %(os_name)s/devel/%(arch)s/%(tree_name)s -yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/41/Everything/%(arch)s/os/ +ref = %(os_name)s/stable/%(arch)s/%(tree_name)s +yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/releases/41/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides lorax_include_packages = fedora-productimg-iot docker_os_name = fedora diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 23dc294..87f7fb4 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -2,7 +2,7 @@ include: - bootupd.yaml # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 - grub2-workaround.yaml -ref: fedora/devel/${basearch}/iot +ref: fedora/stable/${basearch}/iot repos: [] selinux: true ima: true diff --git a/fedora-iot-updates-stable.yaml b/fedora-iot-updates-stable.yaml index 446cfb9..f8d1849 100644 --- a/fedora-iot-updates-stable.yaml +++ b/fedora-iot-updates-stable.yaml @@ -1,2 +1,2 @@ include: fedora-iot-base.yaml -ref: fedora/devel/${basearch}/updates/iot +ref: fedora/stable/${basearch}/updates/iot diff --git a/fedora-iot-updates-testing.yaml b/fedora-iot-updates-testing.yaml index 596961a..11cb696 100644 --- a/fedora-iot-updates-testing.yaml +++ b/fedora-iot-updates-testing.yaml @@ -1,2 +1,2 @@ include: fedora-iot-base.yaml -ref: fedora/devel/${basearch}/testing/iot +ref: fedora/stable/${basearch}/testing/iot diff --git a/fedora-iot.yaml b/fedora-iot.yaml index bcd18ca..eee67dd 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,4 @@ include: fedora-iot-base.yaml -ref: fedora/devel/${basearch}/iot +ref: fedora/stable/${basearch}/iot repos: - fedora-41 From 91539fbf82555ede87f931277a090612a23c5680 Mon Sep 17 00:00:00 2001 From: David Jachimowicz Date: Fri, 15 Nov 2024 16:15:33 +0000 Subject: [PATCH 12/44] Update fedora-iot-base.yaml to sync with osbuild iot-commit Adds ssh-key-dir and ignition-edge packages to base yaml. ssh-key-dir is needed to transfer ssh keys to the iot system during boot and ignition-edge is needed to allow ssh-key-dir to work properly. Explicitly adds fedora-iot-config package. Was previously pulled in as a requirement, added for clarity. Adds fdo-owner-cli package to increase FDO functionality. These changes should help bring the package list more in line with the osbuild iot-commit, as well as rectifying issue 70 and issue 49 (relating to ssh key login and home directory creation on iot systems). Issue 70: https://github.com/fedora-iot/iot-distro/issues/70 Issue 49: https://github.com/fedora-iot/iot-distro/issues/49 Signed-off-by: djach7 --- fedora-iot-base.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 4c64cd1..e6358e3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -73,7 +73,11 @@ check-groups: type: file filename: group packages: +# This list of packages should be kept in sync with +# the iot-commit definition is osbuild, as found here: +# https://github.com/osbuild/images/blob/0584c20b0c14a89e833b875252114ceff61805e8/pkg/distro/fedora/package_sets.go#L123 - fedora-release-iot +- fedora-iot-config - aardvark-dns - atheros-firmware - attr @@ -105,6 +109,7 @@ packages: - e2fsprogs - efibootmgr - fdo-client +- fdo-owner-cli - firewalld - fwupd - fwupd-efi @@ -118,6 +123,7 @@ packages: - gzip - hostname - ignition +- ignition-edge - ima-evm-utils - iproute - iputils @@ -157,6 +163,7 @@ packages: - shadow-utils - skopeo - slirp4netns +- ssh-key-dir - sssd-client - sudo - systemd From c611d4da9615ec908287774382e88fcfaf9ff240 Mon Sep 17 00:00:00 2001 From: djach7 Date: Mon, 16 Dec 2024 14:58:43 -0500 Subject: [PATCH 13/44] Adds bootupd update to boot process Updates bootupd.yaml to enable bootupctl-update upon system boot. This allows bootupd to work as expected on Fedora IoT raw image systems, with all expected components installed. Signed-off-by: djach7 --- bootupd.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/bootupd.yaml b/bootupd.yaml index 3328d41..61a6a9a 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -11,3 +11,22 @@ postprocess: set -xeuo pipefail # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload /usr/bin/bootupctl backend generate-update-metadata + + # Trigger a bootloader update on boot + cat > /usr/lib/systemd/system/bootloader-update.service << 'EOF' + [Unit] + Description=Update bootloader on boot + Documentation=https://github.com/coreos/bootupd + ConditionFirmware=uefi + + [Service] + Type=oneshot + ExecStart=/usr/bin/bootupctl update + RemainAfterExit=yes + MountFlags=slave + + [Install] + WantedBy=multi-user.target + EOF + chmod 644 /usr/lib/systemd/system/bootloader-update.service + echo "enable bootloader-update.service" > /usr/lib/systemd/system-preset/81-iot.preset \ No newline at end of file From 71a1f8be5fcd41feb6602d72691feb7668bb21c4 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 10 Jan 2025 15:04:30 -0500 Subject: [PATCH 14/44] F41: force disable composefs Signed-off-by: Paul Whalen --- composefs.yaml | 11 +++++++++++ fedora-iot-base.yaml | 2 ++ 2 files changed, 13 insertions(+) create mode 100644 composefs.yaml diff --git a/composefs.yaml b/composefs.yaml new file mode 100644 index 0000000..c51f832 --- /dev/null +++ b/composefs.yaml @@ -0,0 +1,11 @@ +# Force disable composefs +# See: https://github.com/ostreedev/ostree/pull/3353 +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + cat >> /usr/lib/ostree/prepare-root.conf << 'EOF' + [composefs] + enabled = no + EOF diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 87f7fb4..a17a42a 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -2,6 +2,8 @@ include: - bootupd.yaml # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 - grub2-workaround.yaml + # Force disable composefs + - composefs.yaml ref: fedora/stable/${basearch}/iot repos: [] selinux: true From 06b41a222ef0964151d0aafb8300738fbf597542 Mon Sep 17 00:00:00 2001 From: djach7 Date: Tue, 28 Jan 2025 13:13:23 -0500 Subject: [PATCH 15/44] Update package list to sync with rawhide and osbuild iot-commit Adds ignition-edge and ssh-key-dir packages to ensure ignition functionality. Also adds fedora-iot-config package and fdo-owner-cli package to bring package list in synch with rawhide and osbuild iot-commit. Osbuild iot-commit found here: https://github.com/osbuild/images/blob/0584c20b0c14a89e833b875252114ceff61805e8/pkg/distro/fedora/package_sets.go#L73 Original update pr for rawhide found here: https://pagure.io/fedora-iot/ostree/c/91539fbf82555ede87f931277a090612a23c5680?branch=main Signed-off-by: djach7 --- fedora-iot-base.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index a17a42a..d11a81e 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -75,7 +75,11 @@ check-groups: type: file filename: group packages: +# This list of packages should be kept in sync with +# the iot-commit definition is osbuild, as found here: +# https://github.com/osbuild/images/blob/0584c20b0c14a89e833b875252114ceff61805e8/pkg/distro/fedora/package_sets.go#L73 - fedora-release-iot +- fedora-iot-config - aardvark-dns - atheros-firmware - attr @@ -107,6 +111,7 @@ packages: - e2fsprogs - efibootmgr - fdo-client +- fdo-owner-cli - firewalld - fwupd - fwupd-efi @@ -120,6 +125,7 @@ packages: - gzip - hostname - ignition +- ignition-edge - ima-evm-utils - iproute - iputils @@ -159,6 +165,7 @@ packages: - shadow-utils - skopeo - slirp4netns +- ssh-key-dir - sssd-client - sudo - systemd From d6ec8e0b0e553a2ce129c21115f89d679b214641 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 4 Feb 2025 15:29:24 -0500 Subject: [PATCH 16/44] IoT: Update rawhide for F-43 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-42.repo => fedora-43.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-42.repo => fedora-43.repo (61%) diff --git a/config.ini b/config.ini index f7e27f5..f09325d 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f42 +release = f43 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-42.repo b/fedora-43.repo similarity index 61% rename from fedora-42.repo rename to fedora-43.repo index f9343b8..c510019 100644 --- a/fedora-42.repo +++ b/fedora-43.repo @@ -1,12 +1,12 @@ -[fedora-42] -name=Fedora 42 - $basearch +[fedora-43] +name=Fedora 43 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/42/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-42&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/43/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-43&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-42-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index e6358e3..11b35f3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -9,8 +9,8 @@ ima: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '42' -mutate-os-release: '42' +automatic_version_prefix: '43' +mutate-os-release: '43' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index f765bfe..2f1ddd3 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-42 +- fedora-43 From 625d7631959acac84ca8d6e9a9955c4cb3969a6e Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Fri, 7 Feb 2025 09:34:26 -0800 Subject: [PATCH 17/44] Replace basesystem with filesystem See https://src.fedoraproject.org/rpms/filesystem/c/3f741bf2a89c9e1bb685943c41fd298e6683dd50?branch=rawhide Signed-off-by: Adam Williamson --- fedora-iot-base.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 11b35f3..fc21de0 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -82,7 +82,6 @@ packages: - atheros-firmware - attr - authselect -- basesystem - bash - bash-completion - bootc @@ -110,6 +109,7 @@ packages: - efibootmgr - fdo-client - fdo-owner-cli +- filesystem - firewalld - fwupd - fwupd-efi From b799fe0c9d8bf09bcfa855b46599f60ecd190f17 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 18 Feb 2025 16:36:16 -0500 Subject: [PATCH 18/44] Remove Zezere and enable systemd-firstboot Remove Zezere and enable systemd-firstboot for local configuration. See: https://fedoraproject.org/wiki/Changes/Retire_Zezere Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index fc21de0..c61164b 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -179,7 +179,6 @@ packages: - wireless-regdb - xfsprogs - xz -- zezere-ignition - zram-generator - zram-generator-defaults packages-aarch64: @@ -200,6 +199,7 @@ units: - fedora-iot-config-remote-fix.service - firewalld.service - sshd.service +- systemd-firstboot.service - greenboot-grub2-set-counter.service - greenboot-grub2-set-success.service - greenboot-healthcheck.service @@ -208,5 +208,3 @@ units: - greenboot-task-runner.service - parsec.service - dbus-parsec.service -- zezere_ignition.timer -- zezere_ignition_banner.service From 17d9d31eb8216fc0ac4d1def372acae86bd4802d Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 18 Feb 2025 16:38:44 -0500 Subject: [PATCH 19/44] Drop parsec no longer supported upstream Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index c61164b..58d3480 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -99,7 +99,6 @@ packages: - criu-libs - cryptsetup - curl -- dbus-parsec - dnf5 - dnf5-plugins - dosfstools @@ -146,7 +145,6 @@ packages: - openssh-server - passt - passt-selinux -- parsec - pinentry - podman - policycoreutils @@ -206,5 +204,3 @@ units: - greenboot-rpm-ostree-grub2-check-fallback.service - greenboot-status.service - greenboot-task-runner.service -- parsec.service -- dbus-parsec.service From ce25ead8e58f35271963d19c792827de443ae869 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Wed, 19 Feb 2025 15:34:27 +0000 Subject: [PATCH 20/44] drop policycoreutils-python-utils in base The policycoreutils-python-utils pulls in a bunch of extra SELinux utils which aren't used in day to day, it pulls in a bunch of python packages, it can easily be layered and isn't generally needed. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 58d3480..c5071fa 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -148,7 +148,6 @@ packages: - pinentry - podman - policycoreutils -- policycoreutils-python-utils - polkit - procps-ng - realtek-firmware From b3fd2930a9249c25e94eb32bbe9dbdfc8843e254 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 24 Feb 2025 10:43:18 -0500 Subject: [PATCH 21/44] Disable ima in ostree due to ongoing compose issues See: https://bugzilla.redhat.com/show_bug.cgi?id=2346265 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index c5071fa..62a22bc 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -5,7 +5,6 @@ include: ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true -ima: true tmp-is-dir: true recommends: false documentation: false From a6e7212b561662f8ce507e51dd95ddc354785b45 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 27 Feb 2025 10:58:35 -0500 Subject: [PATCH 22/44] Migrate systems to a static GRUB config See: https://pagure.io/workstation-ostree-config/pull-request/591 https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops Signed-off-by: Paul Whalen --- bootupd.yaml | 28 +++++++++++----------------- 1 file changed, 11 insertions(+), 17 deletions(-) diff --git a/bootupd.yaml b/bootupd.yaml index 61a6a9a..857de65 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -9,24 +9,18 @@ postprocess: - | #!/bin/bash set -xeuo pipefail + # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload /usr/bin/bootupctl backend generate-update-metadata - - # Trigger a bootloader update on boot - cat > /usr/lib/systemd/system/bootloader-update.service << 'EOF' - [Unit] - Description=Update bootloader on boot - Documentation=https://github.com/coreos/bootupd - ConditionFirmware=uefi - + + # Enable migration to a static GRUB config + install -dm0755 /usr/lib/systemd/system/bootloader-update.service.d + cat > /usr/lib/systemd/system/bootloader-update.service.d/migrate-static-grub-config.conf << 'EOF' [Service] - Type=oneshot - ExecStart=/usr/bin/bootupctl update - RemainAfterExit=yes - MountFlags=slave - - [Install] - WantedBy=multi-user.target + ExecStart=/usr/bin/bootupctl migrate-static-grub-config EOF - chmod 644 /usr/lib/systemd/system/bootloader-update.service - echo "enable bootloader-update.service" > /usr/lib/systemd/system-preset/81-iot.preset \ No newline at end of file + + echo "enable bootloader-update.service" >> /usr/lib/systemd/system-preset/80-iot.preset + + # Turn permissive mode on for bootupd until all SELinux issues are fixed + semanage permissive --noreload --add bootupd_t From c739a8c05ac86fd6f8b8091e9268e22561eb6a2d Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 27 Feb 2025 11:02:20 -0500 Subject: [PATCH 23/44] Enable composefs by default See: https://pagure.io/workstation-ostree-config/pull-request/591 https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops Signed-off-by: Paul Whalen --- composefs.yaml | 12 ++++++++++++ fedora-iot-base.yaml | 2 ++ 2 files changed, 14 insertions(+) create mode 100644 composefs.yaml diff --git a/composefs.yaml b/composefs.yaml new file mode 100644 index 0000000..8a721f3 --- /dev/null +++ b/composefs.yaml @@ -0,0 +1,12 @@ +# Enable composefs +# See: https://fedoraproject.org/wiki/Changes/ComposefsAtomicDesktops +# https://fedoraproject.org/wiki/Changes/ComposefsAtomicCoreOSIoT +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + cat >> /usr/lib/ostree/prepare-root.conf << 'EOF' + [composefs] + enabled = yes + EOF diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 62a22bc..03e21c3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -2,6 +2,8 @@ include: - bootupd.yaml # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 - grub2-workaround.yaml + # Enable composefs + - composefs.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true From 6529ca201d34fc21b338722c97fcccddb5e4ea42 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 27 Feb 2025 14:40:52 +0000 Subject: [PATCH 24/44] iot: drop kernel-tools It too should be layered, not included in the base image. Signed-off-by: Peter Robinson --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 03e21c3..11e982f 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -130,7 +130,6 @@ packages: - iwd - iwlwifi-mvm-firmware - kernel -- kernel-tools - keyutils - less - libsss_sudo From 2fda060e855080cb329c5d637a7dfca68e8e8999 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 6 Mar 2025 14:02:39 -0500 Subject: [PATCH 25/44] Remove grub2-workaround Remove grub2-workaround, bug has been fixed. See: https://bugzilla.redhat.com/show_bug.cgi?id=2305291 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 -- grub2-workaround.yaml | 22 ---------------------- 2 files changed, 24 deletions(-) delete mode 100644 grub2-workaround.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 11e982f..1c13f3f 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,7 +1,5 @@ include: - bootupd.yaml - # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2305291 - - grub2-workaround.yaml # Enable composefs - composefs.yaml ref: fedora/rawhide/${basearch}/iot diff --git a/grub2-workaround.yaml b/grub2-workaround.yaml deleted file mode 100644 index 3b58a9e..0000000 --- a/grub2-workaround.yaml +++ /dev/null @@ -1,22 +0,0 @@ -# Temporarily disable new GRUB2 config options until we can ensure that we -# have an updated bootloader via bootupd. -# This is workaround for: https://bugzilla.redhat.com/show_bug.cgi?id=2305291 -# See: https://github.com/fedora-silverblue/issue-tracker/issues/587 -postprocess: - - | - #!/usr/bin/env bash - set -xeuo pipefail - - # Completely disable this module - sed -i '2i exit 0' /etc/grub.d/25_bli - - # Skip check that was not performed in previous Fedora versions - sed -i '/fwsetup --is-supported/d' /etc/grub.d/30_uefi-firmware - sed -i '/\tif/d' /etc/grub.d/30_uefi-firmware - sed -i '/\tfi/d' /etc/grub.d/30_uefi-firmware - sed -i 's/\t\t/\t/' /etc/grub.d/30_uefi-firmware - - # Verify that the content matches what we expect the file to look like. - # This will fail the build here instead of breaking users' systems. - hash="5a77a16c6a94e664e2e96a870f4531b9a0b4e63be1f46751d01e774629a8c84b" - echo "$hash /etc/grub.d/30_uefi-firmware" | sha256sum -c From 6b92bbcbbc38b5c50cebf01c1f78115376949789 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Fri, 7 Mar 2025 13:49:18 +0100 Subject: [PATCH 26/44] Remove fedora-bootc-base Now moved to https://github.com/fedora-iot/fedora-iot-bootc --- fedora-bootc-base/basic-fixes.yaml | 29 -------- fedora-bootc-base/bootc-config.yaml | 0 fedora-bootc-base/bootc.yaml | 16 ----- fedora-bootc-base/bootupd.yaml | 31 -------- fedora-bootc-base/group | 46 ------------ fedora-bootc-base/grub2-removals.yaml | 8 --- fedora-bootc-base/initramfs.yaml | 24 ------- fedora-bootc-base/iot.yaml | 100 -------------------------- fedora-bootc-base/kernel.yaml | 6 -- fedora-bootc-base/manifest.yaml | 65 ----------------- fedora-bootc-base/ostree.yaml | 17 ----- fedora-bootc-base/passwd | 32 --------- 12 files changed, 374 deletions(-) delete mode 100644 fedora-bootc-base/basic-fixes.yaml delete mode 100644 fedora-bootc-base/bootc-config.yaml delete mode 100644 fedora-bootc-base/bootc.yaml delete mode 100644 fedora-bootc-base/bootupd.yaml delete mode 100644 fedora-bootc-base/group delete mode 100644 fedora-bootc-base/grub2-removals.yaml delete mode 100644 fedora-bootc-base/initramfs.yaml delete mode 100644 fedora-bootc-base/iot.yaml delete mode 100644 fedora-bootc-base/kernel.yaml delete mode 100644 fedora-bootc-base/manifest.yaml delete mode 100644 fedora-bootc-base/ostree.yaml delete mode 100644 fedora-bootc-base/passwd diff --git a/fedora-bootc-base/basic-fixes.yaml b/fedora-bootc-base/basic-fixes.yaml deleted file mode 100644 index d9fe059..0000000 --- a/fedora-bootc-base/basic-fixes.yaml +++ /dev/null @@ -1,29 +0,0 @@ -# Fix general bugs - -postprocess: - # See also https://github.com/openshift/os/blob/f6cde963ee140c02364674db378b2bc4ac42675b/common.yaml#L156 - # This one is undoes the effect of - # # RHEL-only: Disable /tmp on tmpfs. - #Wants=tmp.mount - # in /usr/lib/systemd/system/basic.target - # We absolutely must have tmpfs-on-tmp for multiple reasons, - # but the biggest is that when we have composefs for / it's read-only, - # and for units with ProtectSystem=full systemd clones / but needs - # a writable place. - - | - #!/usr/bin/env bash - set -xeuo pipefail - mkdir -p /usr/lib/systemd/system/local-fs.target.wants - if test '!' -f /usr/lib/systemd/system/local-fs.target.wants/tmp.mount; then - ln -sf ../tmp.mount /usr/lib/systemd/system/local-fs.target.wants - fi - - # See https://github.com/containers/bootc/issues/358 - # basically systemd-tmpfiles doesn't follow symlinks; ordinarily our - # tmpfiles.d unit for `/var/roothome` is fine, but this actually doesn't - # work if we want to use tmpfiles.d to write to `/root/.ssh` because - # tmpfiles gives up on that before getting to `/var/roothome`. - sed -ie 's, /root, /var/roothome,' /usr/lib/tmpfiles.d/provision.conf - # Because /var/roothome is also defined in rpm-ostree-0-integration.conf - # we need to delete /var/roothome - sed -ie '/^d- \/var\/roothome /d' /usr/lib/tmpfiles.d/provision.conf diff --git a/fedora-bootc-base/bootc-config.yaml b/fedora-bootc-base/bootc-config.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/fedora-bootc-base/bootc.yaml b/fedora-bootc-base/bootc.yaml deleted file mode 100644 index d44ee08..0000000 --- a/fedora-bootc-base/bootc.yaml +++ /dev/null @@ -1,16 +0,0 @@ -# The bootc components. -packages: - - systemd - - bootc - # bootc pulls in podman, which pulls in containers-common, which wants - # `iptables`. Currently that pulls in iptables-legacy. Let's explicitly name - # iptables-nft instead to satisfy it. - - iptables-nft - # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk - - gdisk xfsprogs e2fsprogs dosfstools - -exclude-packages: - # Exclude kernel-debug-core to make sure that it doesn't somehow get - # chosen as the package to satisfy the `kernel-core` dependency from - # the kernel package. - - kernel-debug-core diff --git a/fedora-bootc-base/bootupd.yaml b/fedora-bootc-base/bootupd.yaml deleted file mode 100644 index cc83d20..0000000 --- a/fedora-bootc-base/bootupd.yaml +++ /dev/null @@ -1,31 +0,0 @@ -# Integration with https://github.com/coreos/bootupd and bootloader logic -# xref https://github.com/coreos/fedora-coreos-tracker/issues/510 -packages: - - bootupd - -# bootloader -packages-aarch64: - - grub2-efi-aa64 efibootmgr shim -packages-ppc64le: - - grub2 ostree-grub2 -packages-s390x: - # On Fedora, this is provided by s390utils-core. on RHEL, this is for now - # provided by s390utils-base, but soon will be -core too. - - /usr/sbin/zipl -packages-x86_64: - - grub2-efi-x64 efibootmgr shim - - microcode_ctl - -conditional-include: - - if: basearch != "s390x" - # And remove some cruft from grub2 - include: grub2-removals.yaml - -postprocess: - - | - #!/bin/bash - set -xeuo pipefail - # Until we have https://github.com/coreos/rpm-ostree/pull/2275 - mkdir -p /run - # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload - /usr/bin/bootupctl backend generate-update-metadata diff --git a/fedora-bootc-base/group b/fedora-bootc-base/group deleted file mode 100644 index 2fd197c..0000000 --- a/fedora-bootc-base/group +++ /dev/null @@ -1,46 +0,0 @@ -root:x:0: -bin:x:1: -daemon:x:2: -sys:x:3: -adm:x:4: -tty:x:5: -disk:x:6: -lp:x:7: -mem:x:8: -kmem:x:9: -wheel:x:10: -cdrom:x:11: -mail:x:12: -man:x:15: -sudo:x:16: -dialout:x:18: -floppy:x:19: -games:x:20: -tape:x:33: -video:x:39: -ftp:x:50: -lock:x:54: -audio:x:63: -nobody:x:99: -users:x:100: -ssh_keys:x:999: -systemd-journal:x:190: -polkitd:x:998: -etcd:x:997: -dip:x:40: -cgred:x:996: -avahi-autoipd:x:170: -sssd:x:993: -dockerroot:x:986: -rpcuser:x:29: -nfsnobody:x:65534: -kube:x:994: -chrony:x:992: -tcpdump:x:72: -ceph:x:167: -input:x:104: -systemd-timesync:x:991: -systemd-network:x:990: -systemd-resolve:x:989: -systemd-bus-proxy:x:988: -cockpit-ws:x:987: diff --git a/fedora-bootc-base/grub2-removals.yaml b/fedora-bootc-base/grub2-removals.yaml deleted file mode 100644 index f4800dd..0000000 --- a/fedora-bootc-base/grub2-removals.yaml +++ /dev/null @@ -1,8 +0,0 @@ -remove-from-packages: - # The grub bits are mainly designed for desktops, and IMO haven't seen - # enough testing in concert with ostree. At some point we'll flesh out - # the full plan in https://github.com/coreos/fedora-coreos-tracker/issues/47 - - [grub2-tools, /etc/grub.d/08_fallback_counting, - /etc/grub.d/10_reset_boot_success, - /etc/grub.d/12_menu_auto_hide, - /usr/lib/systemd/.*] diff --git a/fedora-bootc-base/initramfs.yaml b/fedora-bootc-base/initramfs.yaml deleted file mode 100644 index fe4bbeb..0000000 --- a/fedora-bootc-base/initramfs.yaml +++ /dev/null @@ -1,24 +0,0 @@ -# Configuration for the initramfs -postprocess: - - | - #!/usr/bin/env bash - mkdir -p /usr/lib/dracut/dracut.conf.d - cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF' - # We want a generic image; hostonly makes no sense as part of a server side build - hostonly=no - add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree " - EOF - cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF' - # Extra modules that we want by default that are known to exist in the kernel - add_dracutmodules+=" virtiofs " - EOF - cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF' - # We want this for systemd-cryptsetup tpm2 locking - add_dracutmodules+=" tpm2-tss " - EOF - cat > /usr/lib/dracut/dracut.conf.d/59-altfiles.conf << 'EOF' - # https://issues.redhat.com/browse/RHEL-49590 - # On image mode systems we use nss-altfiles for passwd and group, - # this makes sure dracut uses them which also fixes kdump writing to NFS. - install_items+=" /usr/lib/passwd /usr/lib/group " - EOF diff --git a/fedora-bootc-base/iot.yaml b/fedora-bootc-base/iot.yaml deleted file mode 100644 index 611ff9a..0000000 --- a/fedora-bootc-base/iot.yaml +++ /dev/null @@ -1,100 +0,0 @@ -# Fedora IoT specific packages -packages: - - fedora-release-iot - - aardvark-dns - - atheros-firmware - - attr - - authselect - - basesystem - - bash - - bash-completion - - brcmfmac-firmware - - chrony - - clevis - - clevis-dracut - - clevis-luks - - clevis-pin-tpm2 - - containernetworking-plugins - - coreutils - - cracklib-dicts - - criu - - criu-libs - - cryptsetup - - curl - - dbus-parsec - - dnf5-plugins - - dracut-config-generic - - dracut-network - - efibootmgr - - fdo-client - - firewalld - - fwupd - - fwupd-efi - - fwupd-plugin-modem-manager - - fwupd-plugin-uefi-capsule-data - - glibc - - glibc-minimal-langpack - - gnupg2 - - greenboot - - greenboot-default-health-checks - - gzip - - hostname - - ignition - - ima-evm-utils - - iproute - - iputils - - iwd - - iwlwifi-mvm-firmware - - kernel-tools - - keyutils - - less - - libsss_sudo - - linux-firmware - - lvm2 - - netavark - - NetworkManager - - NetworkManager-wifi - - NetworkManager-wwan - - nss-altfiles - - openssl - - openssh-clients - - openssh-server - - passt - - passt-selinux - - parsec - - pinentry - - podman - - policycoreutils - - policycoreutils-python-utils - - polkit - - procps-ng - - realtek-firmware - - rootfiles - - rpm - - screen - - setools-console - - setup - - shadow-utils - - skopeo - - slirp4netns - - sssd-client - - sudo - - systemd-resolved - - tar - - tmux - - tpm2-pkcs11 - - traceroute - - usbguard - - util-linux - - vim-minimal - - wpa_supplicant - - wireless-regdb - - xz - - zezere-ignition - - zram-generator - - zram-generator-defaults -packages-aarch64: - - arm-image-installer - - bcm283x-firmware - - optee_client - - uboot-images-armv8 diff --git a/fedora-bootc-base/kernel.yaml b/fedora-bootc-base/kernel.yaml deleted file mode 100644 index 0dd777d..0000000 --- a/fedora-bootc-base/kernel.yaml +++ /dev/null @@ -1,6 +0,0 @@ -# Enable the Linux kernel; see also kernel-rt. -packages: - - kernel - -exclude-packages: - - kernel-debug diff --git a/fedora-bootc-base/manifest.yaml b/fedora-bootc-base/manifest.yaml deleted file mode 100644 index 9a21ff3..0000000 --- a/fedora-bootc-base/manifest.yaml +++ /dev/null @@ -1,65 +0,0 @@ - -# Modern defaults we want -boot-location: modules -tmp-is-dir: true -# https://github.com/CentOS/centos-bootc/issues/167 -machineid-compat: true -# Be minimal -recommends: false - -ignore-removed-users: - - root -ignore-removed-groups: - - root -etc-group-members: - - wheel - - sudo - - systemd-journal - - adm - -# Default to `bash` in our container, the same as other containers we ship. -container-cmd: - - /sbin/init - -# Note that the default for c9s+ is sqlite; we can't rely on rpm being -# in the target (it isn't in tier-0!) so turn this to host here. This -# does break the "hermetic build" aspect a bit. Maybe eventually -# what we should do is special case this and actually install RPM temporarily -# and then remove it... -rpmdb: host - -check-passwd: - type: "file" - filename: "passwd" -check-groups: - type: "file" - filename: "group" - -automatic-version-prefix: "${releasever}." -mutate-os-release: "${releasever}" - -remove-from-packages: - # Generally we expect other tools to do this (e.g. Ignition or cloud-init) - - [systemd, /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service] - # We don't want auto-generated mount units. See also - # https://github.com/systemd/systemd/issues/13099 - - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator] - -include: - - bootc.yaml - - bootupd.yaml - - ostree.yaml - - initramfs.yaml - - basic-fixes.yaml - - iot.yaml - -packages: - # needed for building derived container images - - dnf5 - # Even in tier-0, we have this. If you don't want SELinux today, you'll need - # to build a custom image. - - selinux-policy-targeted - # And we want container-selinux because trying to layer it on later currently causes issues. - - container-selinux - # Needed for tpm2 bound luks - - tpm2-tools diff --git a/fedora-bootc-base/ostree.yaml b/fedora-bootc-base/ostree.yaml deleted file mode 100644 index 6f30861..0000000 --- a/fedora-bootc-base/ostree.yaml +++ /dev/null @@ -1,17 +0,0 @@ -packages: - - ostree nss-altfiles - -# We want content lifecycled with the image -opt-usrlocal: "root" - -postprocess: - # Set up default root config - - | - #!/usr/bin/env bash - mkdir -p /usr/lib/ostree - cat > /usr/lib/ostree/prepare-root.conf << EOF - [composefs] - enabled = yes - [sysroot] - readonly = true - EOF diff --git a/fedora-bootc-base/passwd b/fedora-bootc-base/passwd deleted file mode 100644 index ea84802..0000000 --- a/fedora-bootc-base/passwd +++ /dev/null @@ -1,32 +0,0 @@ -adm:x:3:4:adm:/var/adm:/usr/sbin/nologin -avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/usr/sbin/nologin -bin:x:1:1:bin:/bin:/usr/sbin/nologin -ceph:x:167:167:Ceph daemons:/var/lib/ceph:/usr/sbin/nologin -chrony:x:994:992::/var/lib/chrony:/usr/sbin/nologin -cockpit-ws:x:988:987:User for cockpit-ws:/:/usr/sbin/nologin -daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin -dbus:x:81:81:System Message Bus:/:/usr/sbin/nologin -dockerroot:x:997:986:Docker User:/var/lib/docker:/usr/sbin/nologin -etcd:x:998:997:etcd user:/var/lib/etcd:/usr/sbin/nologin -ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin -games:x:12:100:games:/usr/games:/usr/sbin/nologin -halt:x:7:0:halt:/sbin:/sbin/halt -kube:x:996:994:Kubernetes user:/:/usr/sbin/nologin -lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin -mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin -nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/usr/sbin/nologin -nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin -operator:x:11:0:operator:/root:/usr/sbin/nologin -polkitd:x:999:998:User for polkitd:/:/usr/sbin/nologin -root:x:0:0:Super User:/root:/bin/bash -rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin -rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin -shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown -sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin -sssd:x:995:993:User for sssd:/:/usr/sbin/nologin -sync:x:5:0:sync:/sbin:/bin/sync -systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin -systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin -systemd-resolve:x:990:989:systemd Resolver:/:/usr/sbin/nologin -systemd-timesync:x:993:991:systemd Time Synchronization:/:/usr/sbin/nologin -tcpdump:x:72:72::/:/usr/sbin/nologin From e4bd292f1ab6ea63403b99efbe82e9c7fb47b602 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Wed, 19 Feb 2025 19:07:22 +0100 Subject: [PATCH 27/44] Whitespace & indentation cleanup --- bootupd.yaml | 4 ++-- fedora-iot.yaml | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/bootupd.yaml b/bootupd.yaml index 857de65..e15c48a 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -1,7 +1,7 @@ # KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml # See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml # -#Integration with https://github.com/coreos/bootupd +# Integration with https://github.com/coreos/bootupd packages: - bootupd @@ -12,7 +12,7 @@ postprocess: # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload /usr/bin/bootupctl backend generate-update-metadata - + # Enable migration to a static GRUB config install -dm0755 /usr/lib/systemd/system/bootloader-update.service.d cat > /usr/lib/systemd/system/bootloader-update.service.d/migrate-static-grub-config.conf << 'EOF' diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 2f1ddd3..7f39e3e 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -1,4 +1,5 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot + repos: - fedora-43 From ce81f37ea5a7419a16eb03343c553129a96964c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Wed, 19 Feb 2025 19:07:37 +0100 Subject: [PATCH 28/44] ci: Add a script to help validate manifest syntax --- ci/validate | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100755 ci/validate diff --git a/ci/validate b/ci/validate new file mode 100755 index 0000000..c9e6a32 --- /dev/null +++ b/ci/validate @@ -0,0 +1,57 @@ +#!/usr/bin/python3 +# Validate basic syntax of shell script and yaml. + +import os +import stat +import subprocess +import yaml + +validated=0 + +def openat(dirfd, name, mode='r'): + def opener(path, flags): + return os.open(path, flags, dir_fd=dirfd) + return open(name, mode, opener=opener) + + +def validate_shell(rootfd, name): + subprocess.check_call(['bash', '-n', name], preexec_fn=lambda: os.fchdir(rootfd)) + global validated + validated +=1 + + +for root, dirs, files, rootfd in os.fwalk('.'): + # Skip folders that do not include content to validate + for d in ['.git', '.github', 'repo', 'cache', 'tmp', 'logs', 'fedora-comps']: + if d in dirs: + dirs.remove(d) + for f in ['.gitlab-ci.yml']: + if f in files: + files.remove(f) + for name in files: + if name.endswith(('.yaml', '.yml')): + print("Validating:", name) + with open(os.open(name, dir_fd=rootfd, flags=os.O_RDONLY)) as f: + yaml.safe_load(f) + result = subprocess.run(['grep', '-RniEv', '^( )*[a-z#/-]|^( )*\\[|^$|^#', name], encoding='UTF-8', + preexec_fn=lambda: os.fchdir(rootfd)) + if result.returncode == 0: + raise Exception("Found likely invalid indentation in YAML file: {}".format(name)) + validated +=1 + continue + elif name.endswith('.sh'): + print("Validating:", name) + validate_shell(rootfd, name) + continue + stbuf = os.lstat(name, dir_fd=rootfd) + if not stat.S_ISREG(stbuf.st_mode): + continue + if not stbuf.st_mode & stat.S_IXUSR: + continue + mimetype = subprocess.check_output(['file', '-b', '--mime-type', name], encoding='UTF-8', + preexec_fn=lambda: os.fchdir(rootfd)).strip() + if mimetype == 'text/x-shellscript': + print("Validating:", name) + validate_shell(rootfd, name) + +print(f"Validated {validated} files") From 465d88c040cc3f40e1967479f23aee90d84c0dde Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Wed, 19 Feb 2025 19:07:56 +0100 Subject: [PATCH 29/44] Add a justfile with common commands --- justfile | 156 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 156 insertions(+) create mode 100644 justfile diff --git a/justfile b/justfile new file mode 100644 index 0000000..313ea6c --- /dev/null +++ b/justfile @@ -0,0 +1,156 @@ +# This is a justfile. See https://github.com/casey/just +# This is only used for local development. The builds made on the Fedora +# infrastructure are run via Pungi in a Koji runroot. + +# Set a default for some recipes +default_variant := "fedora-iot" +default_arch := "default" +# Current default in Pungi +force_nocache := "true" + +# Just doesn't have a native dict type, but quoted bash dictionary works fine +pretty_names := '( + [fedora-iot]="IoT" +)' + +# Default is to only validate the manifests +all: validate + +# Basic validation to make sure the manifests are not completely broken +validate: + ./ci/validate + +# Output the processed manifest for a given variant (defaults to Silverblue) +manifest variant=default_variant: + #!/bin/bash + set -euo pipefail + + rpm-ostree compose tree --print-only --repo=repo {{variant}}.yaml + +# Perform dependency resolution for a given variant (defaults to Silverblue) +compose-dry-run variant=default_variant: + #!/bin/bash + set -euxo pipefail + + mkdir -p repo cache logs + if [[ ! -f "repo/config" ]]; then + pushd repo > /dev/null || exit 1 + ostree init --repo . --mode=bare-user + popd > /dev/null || exit 1 + fi + + rpm-ostree compose tree --unified-core --repo=repo --dry-run {{variant}}.yaml + +# Alias/shortcut for compose-image command +compose variant=default_variant: (compose-image variant) + +# Compose a variant using the legacy non container path (defaults to Silverblue) +compose-legacy variant=default_variant: + #!/bin/bash + set -euxo pipefail + + declare -A pretty_names={{pretty_names}} + variant={{variant}} + variant_pretty=${pretty_names[$variant]-} + if [[ -z $variant_pretty ]]; then + echo "Unknown variant" + exit 1 + fi + + ./ci/validate > /dev/null || (echo "Failed manifest validation" && exit 1) + + mkdir -p repo cache logs + if [[ ! -f "repo/config" ]]; then + pushd repo > /dev/null || exit 1 + ostree init --repo . --mode=bare-user + popd > /dev/null || exit 1 + fi + # Set option to reduce fsync for transient builds + ostree --repo=repo config set 'core.fsync' 'false' + + buildid="$(date '+%Y%m%d.0')" + timestamp="$(date --iso-8601=sec)" + echo "${buildid}" > .buildid + + version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')" + echo "Composing ${variant_pretty} ${version}.${buildid} ..." + + ARGS="--repo=repo --cachedir=cache" + ARGS+=" --unified-core" + if [[ {{force_nocache}} == "true" ]]; then + ARGS+=" --force-nocache" + fi + CMD="rpm-ostree" + if [[ ${EUID} -ne 0 ]]; then + CMD="sudo rpm-ostree" + fi + + ${CMD} compose tree ${ARGS} \ + --add-metadata-string="version=${variant_pretty} ${version}.${buildid}" \ + "${variant}-ostree.yaml" \ + |& tee "logs/${variant}_${version}_${buildid}.${timestamp}.log" + + if [[ ${EUID} -ne 0 ]]; then + sudo chown --recursive "$(id --user --name):$(id --group --name)" repo cache + fi + + ostree summary --repo=repo --update + +# Compose an Ostree Native Container OCI image +compose-image variant=default_variant: + #!/bin/bash + set -euxo pipefail + + declare -A pretty_names={{pretty_names}} + variant={{variant}} + variant_pretty=${pretty_names[$variant]-} + if [[ -z $variant_pretty ]]; then + echo "Unknown variant" + exit 1 + fi + + ./ci/validate > /dev/null || (echo "Failed manifest validation" && exit 1) + + mkdir -p repo cache + if [[ ! -f "repo/config" ]]; then + pushd repo > /dev/null || exit 1 + ostree init --repo . --mode=bare-user + popd > /dev/null || exit 1 + fi + # Set option to reduce fsync for transient builds + ostree --repo=repo config set 'core.fsync' 'false' + + buildid="$(date '+%Y%m%d.0')" + timestamp="$(date --iso-8601=sec)" + echo "${buildid}" > .buildid + + version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')" + echo "Composing ${variant_pretty} ${version}.${buildid} ..." + + ARGS="--cachedir=cache --initialize" + if [[ {{force_nocache}} == "true" ]]; then + ARGS+=" --force-nocache" + fi + # To debug with gdb, use: gdb --args ... + CMD="rpm-ostree" + if [[ ${EUID} -ne 0 ]]; then + CMD="sudo rpm-ostree" + fi + + ${CMD} compose image ${ARGS} \ + --label="quay.expires-after=4w" \ + "${variant}.yaml" \ + "${variant}.ociarchive" + +# Clean up everything +clean-all: + just clean-repo + just clean-cache + +# Only clean the ostree repo +clean-repo: + rm -rf ./repo + +# Only clean the package and repo caches +clean-cache: + rm -rf ./cache From c7f2ffe7cb170e0ae1180f2a10442b0718d622a2 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 17 Mar 2025 13:19:32 -0400 Subject: [PATCH 30/44] Default root config to mount sysroot as read only See: https://github.com/fedora-iot/iot-distro/issues/81 https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/ostree.yaml Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 ++ sysroot-ro.yaml | 15 +++++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 sysroot-ro.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 1c13f3f..08e92cf 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -2,6 +2,8 @@ include: - bootupd.yaml # Enable composefs - composefs.yaml + # Read only sysroot + - sysroot-ro.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true diff --git a/sysroot-ro.yaml b/sysroot-ro.yaml new file mode 100644 index 0000000..8214f05 --- /dev/null +++ b/sysroot-ro.yaml @@ -0,0 +1,15 @@ +# Set up default root config to mount sysroot as read only +# https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot +# See: https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/ostree.yaml +# See: https://github.com/fedora-iot/iot-distro/issues/81 + +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + install -dm 0755 -o 0 -g 0 /usr/lib/ostree + cat >> /usr/lib/ostree/prepare-root.conf << 'EOF' + [sysroot] + readonly = true + EOF From a6f6d3e9d7302219b4439a290f864b06ea91b0aa Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 8 Apr 2025 10:04:41 -0400 Subject: [PATCH 31/44] Drop bash-completion due to duplicate file issue with libsecret See: https://github.com/fedora-iot/iot-distro/issues/87 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index d11a81e..4cc389a 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -86,7 +86,6 @@ packages: - authselect - basesystem - bash -- bash-completion - bootc - brcmfmac-firmware - chrony From cc96761b139c82ffa91d8271e223e2318aa78361 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 11 Aug 2025 14:25:38 -0400 Subject: [PATCH 32/44] IoT: Update rawhide for F-44 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-43.repo => fedora-44.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-43.repo => fedora-44.repo (61%) diff --git a/config.ini b/config.ini index f09325d..4dbcdf5 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f43 +release = f44 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-43.repo b/fedora-44.repo similarity index 61% rename from fedora-43.repo rename to fedora-44.repo index c510019..99cde87 100644 --- a/fedora-43.repo +++ b/fedora-44.repo @@ -1,12 +1,12 @@ -[fedora-43] -name=Fedora 43 - $basearch +[fedora-44] +name=Fedora 44 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/43/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-43&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/44/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-44&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 08e92cf..2172526 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -10,8 +10,8 @@ selinux: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '43' -mutate-os-release: '43' +automatic_version_prefix: '44' +mutate-os-release: '44' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 7f39e3e..8da9960 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -2,4 +2,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-43 +- fedora-44 From fc7be035129cd2246053197056b0dedd3de25551 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 4 Feb 2026 11:07:52 -0500 Subject: [PATCH 33/44] fix: drop ssh-key-dir Package has been deprecated in F44. See: https://github.com/coreos/ssh-key-dir/issues/188 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 2172526..116e78f 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -160,7 +160,6 @@ packages: - shadow-utils - skopeo - slirp4netns -- ssh-key-dir - sssd-client - sudo - systemd From dccd3a2e18cbe1c3e7ae121cdd738e61693043f4 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Fri, 6 Feb 2026 11:22:08 -0500 Subject: [PATCH 34/44] IoT: Update rawhide for F-45 Signed-off-by: Paul Whalen --- config.ini | 2 +- fedora-44.repo => fedora-45.repo | 10 +++++----- fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) rename fedora-44.repo => fedora-45.repo (61%) diff --git a/config.ini b/config.ini index 4dbcdf5..2e7f7da 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f44 +release = f45 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-44.repo b/fedora-45.repo similarity index 61% rename from fedora-44.repo rename to fedora-45.repo index 99cde87..85e6dd9 100644 --- a/fedora-44.repo +++ b/fedora-45.repo @@ -1,12 +1,12 @@ -[fedora-44] -name=Fedora 44 - $basearch +[fedora-45] +name=Fedora 45 - $basearch failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/44/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-44&arch=$basearch +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/45/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-45&arch=$basearch enabled=1 #metadata_expire=7d repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-$basearch +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-45-$basearch skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 116e78f..6178ec3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -10,8 +10,8 @@ selinux: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '44' -mutate-os-release: '44' +automatic_version_prefix: '45' +mutate-os-release: '45' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 8da9960..4e3caeb 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -2,4 +2,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-44 +- fedora-45 From 240bff70e742b6916271144f9d61ca79bc98f24b Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 10 Feb 2026 15:44:02 -0500 Subject: [PATCH 35/44] fix: add systemd-pam to fix rootless podman In Fedora 44 systemd changed systemd-pam to recommends and it was dropped from the compose. See: https://github.com/fedora-iot/iot-distro/issues/127 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 6178ec3..d159307 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -163,6 +163,7 @@ packages: - sssd-client - sudo - systemd +- systemd-pam - systemd-resolved - tar - tmux From e0898e8a38c5b9a5a9bc848bdd5cb1d6e51b600b Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 24 Feb 2026 15:36:39 -0500 Subject: [PATCH 36/44] fix: restore SSH key management for Ignition Configures OpenSSH to read keys from ~/.ssh/authorized_keys.d/* in addition to authorized_keys, restoring functionality lost when ssh-key-dir was removed. Follows the same approach as CoreOS: https://github.com/coreos/fedora-coreos-config/pull/3885 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 4 +++- sshd-authorized-keys.yaml | 21 +++++++++++++++++++++ 2 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 sshd-authorized-keys.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index d159307..329fac2 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -1,9 +1,11 @@ -include: +include: - bootupd.yaml # Enable composefs - composefs.yaml # Read only sysroot - sysroot-ro.yaml + # SSH authorized keys configuration for Ignition + - sshd-authorized-keys.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml new file mode 100644 index 0000000..07657bc --- /dev/null +++ b/sshd-authorized-keys.yaml @@ -0,0 +1,21 @@ +# Configuration to have OpenSSH read authorized keys from files in +# ~/.ssh/authorized_keys.d/* in addition to ~/.ssh/authorized_keys +# This enables Ignition to write keys to authorized_keys.d/ignition +# +# Replaces the deprecated ssh-key-dir package +# See: https://github.com/coreos/ssh-key-dir/issues/188 +# See: https://github.com/coreos/fedora-coreos-config/pull/3885 + +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + # Create sshd config directory if it doesn't exist + install -dm 0755 -o 0 -g 0 /etc/ssh/sshd_config.d + + # Configure sshd to read keys from authorized_keys.d directory + cat > /etc/ssh/sshd_config.d/40-authorized-keys-file.conf << 'EOF' + # Also accept keys configured by Ignition and Afterburn + AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/* + EOF From 7a121ed5e79b27529a6adaa3467b3c7f97e2d1ce Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 24 Feb 2026 15:52:24 -0500 Subject: [PATCH 37/44] fix: do not create etc/ssh/sshd_config.d Do not create etc/ssh/sshd_config.d, it should already exist and is owned by openssh-clients and systemd. Signed-off-by: Paul Whalen --- sshd-authorized-keys.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml index 07657bc..600321f 100644 --- a/sshd-authorized-keys.yaml +++ b/sshd-authorized-keys.yaml @@ -11,9 +11,6 @@ postprocess: #!/usr/bin/env bash set -xeuo pipefail - # Create sshd config directory if it doesn't exist - install -dm 0755 -o 0 -g 0 /etc/ssh/sshd_config.d - # Configure sshd to read keys from authorized_keys.d directory cat > /etc/ssh/sshd_config.d/40-authorized-keys-file.conf << 'EOF' # Also accept keys configured by Ignition and Afterburn From 1b3ede31d963d32f8789f6e7393d4cd19bfe60a0 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 24 Feb 2026 17:04:31 -0500 Subject: [PATCH 38/44] fix: use 90- prefix for authorized-keys-file.conf Updates the config file numbering to ensure crypto policies(40) and security configs(50) are applied before user keys are sourced. Signed-off-by: Paul Whalen --- sshd-authorized-keys.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml index 600321f..4080a64 100644 --- a/sshd-authorized-keys.yaml +++ b/sshd-authorized-keys.yaml @@ -12,7 +12,7 @@ postprocess: set -xeuo pipefail # Configure sshd to read keys from authorized_keys.d directory - cat > /etc/ssh/sshd_config.d/40-authorized-keys-file.conf << 'EOF' + cat > /etc/ssh/sshd_config.d/90-authorized-keys-file.conf << 'EOF' # Also accept keys configured by Ignition and Afterburn AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/* EOF From e49d841a842753be9b7d3ff0fd5dabdf38cda6f6 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Thu, 26 Feb 2026 15:07:19 -0500 Subject: [PATCH 39/44] fix: drop sshd-authorized-keys workaround Openssh config snippet now shipped with ignition. See: https://src.fedoraproject.org/rpms/ignition/pull-request/143 Signed-off-by: Paul Whalen --- fedora-iot-base.yaml | 2 -- sshd-authorized-keys.yaml | 18 ------------------ 2 files changed, 20 deletions(-) delete mode 100644 sshd-authorized-keys.yaml diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index 329fac2..ed81137 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -4,8 +4,6 @@ include: - composefs.yaml # Read only sysroot - sysroot-ro.yaml - # SSH authorized keys configuration for Ignition - - sshd-authorized-keys.yaml ref: fedora/rawhide/${basearch}/iot repos: [] selinux: true diff --git a/sshd-authorized-keys.yaml b/sshd-authorized-keys.yaml deleted file mode 100644 index 4080a64..0000000 --- a/sshd-authorized-keys.yaml +++ /dev/null @@ -1,18 +0,0 @@ -# Configuration to have OpenSSH read authorized keys from files in -# ~/.ssh/authorized_keys.d/* in addition to ~/.ssh/authorized_keys -# This enables Ignition to write keys to authorized_keys.d/ignition -# -# Replaces the deprecated ssh-key-dir package -# See: https://github.com/coreos/ssh-key-dir/issues/188 -# See: https://github.com/coreos/fedora-coreos-config/pull/3885 - -postprocess: - - | - #!/usr/bin/env bash - set -xeuo pipefail - - # Configure sshd to read keys from authorized_keys.d directory - cat > /etc/ssh/sshd_config.d/90-authorized-keys-file.conf << 'EOF' - # Also accept keys configured by Ignition and Afterburn - AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/* - EOF From ce421037460b975d95281855fb2ae9f027eba285 Mon Sep 17 00:00:00 2001 From: Joel Capitao Date: Thu, 12 Mar 2026 09:44:22 +0100 Subject: [PATCH 40/44] Remove ignition package Since [1], the ignition-edge subpackage requires ignition, so it's no longer needed to require ignition explicitly here. [1] https://src.fedoraproject.org/rpms/ignition/c/3ccce9fe2c0462f4a17923937933ab9c26db0aa5?branch=rawhide --- fedora-iot-base.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index ed81137..fc454fd 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -122,7 +122,6 @@ packages: - greenboot-default-health-checks - gzip - hostname -- ignition - ignition-edge - ima-evm-utils - iproute From 3738d4889fe646799213cd552c01421b5611a84f Mon Sep 17 00:00:00 2001 From: Kenneth Giusti Date: Mon, 15 Jun 2026 12:56:47 -0400 Subject: [PATCH 41/44] fix: use kmscon as default VT console The kernel console fbcon has been replaced with the userspace console kmscon in Fedora 45. See: https://github.com/fedora-iot/iot-distro/issues/137 Signed-off-by: Kenneth Giusti --- fedora-iot-base.yaml | 1 + justfile | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index fc454fd..f15f5e3 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -130,6 +130,7 @@ packages: - iwlwifi-mvm-firmware - kernel - keyutils +- kmscon - less - libsss_sudo - linux-firmware diff --git a/justfile b/justfile index 313ea6c..3eaf256 100644 --- a/justfile +++ b/justfile @@ -87,7 +87,7 @@ compose-legacy variant=default_variant: ${CMD} compose tree ${ARGS} \ --add-metadata-string="version=${variant_pretty} ${version}.${buildid}" \ - "${variant}-ostree.yaml" \ + "${variant}.yaml" \ |& tee "logs/${variant}_${version}_${buildid}.${timestamp}.log" if [[ ${EUID} -ne 0 ]]; then From 63d2e9c3f52e65f502cefafb39725f4b13e8843f Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Tue, 28 Jul 2026 16:15:56 -0400 Subject: [PATCH 42/44] Update workstation-ostree-config references to Forge - bootupd.yaml: Update comment URL to atomic-desktops/config on Forge - treecompose-post.sh: Update comment URL to atomic-desktops/config on Forge Assisted-by: Claude Opus 4.6 Signed-off-by: Paul Whalen --- bootupd.yaml | 2 +- treecompose-post.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/bootupd.yaml b/bootupd.yaml index e15c48a..62ebb0d 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -1,5 +1,5 @@ # KEEP THIS IN SYNC WITH https://github.com/coreos/fedora-coreos-config/blob/testing-devel/manifests/bootupd.yaml -# See also: https://pagure.io/workstation-ostree-config/blob/main/f/bootupd.yaml +# See also: https://forge.fedoraproject.org/atomic-desktops/config/src/branch/main/bootupd.yaml # # Integration with https://github.com/coreos/bootupd packages: diff --git a/treecompose-post.sh b/treecompose-post.sh index a47d8cf..e62b942 100755 --- a/treecompose-post.sh +++ b/treecompose-post.sh @@ -18,7 +18,7 @@ done # Remove loader directory causing issues in Anaconda in unified core mode # Will be obsolete once we start using bootupd -# See - https://pagure.io/workstation-ostree-config/pull-request/344 +# See - https://forge.fedoraproject.org/atomic-desktops/config/pulls/344 rm -rf /usr/lib/ostree-boot/loader # Undo RPM scripts enabling units; we want the presets to be canonical From f570c87de928f01e14722144ff3d227c151201d0 Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Wed, 12 Aug 2026 10:17:54 -0400 Subject: [PATCH 43/44] Bump rawhide to Fedora 46 --- config.ini | 2 +- fedora-46.repo | 12 ++++++++++++ fedora-iot-base.yaml | 4 ++-- fedora-iot.yaml | 2 +- 4 files changed, 16 insertions(+), 4 deletions(-) create mode 100644 fedora-46.repo diff --git a/config.ini b/config.ini index 2e7f7da..a91c1c6 100644 --- a/config.ini +++ b/config.ini @@ -10,7 +10,7 @@ os_pretty_name = Fedora IoT tree_name = docker-host tree_file = %(os_name)s-%(tree_name)s.json arch = x86_64 -release = f45 +release = f46 ref = %(os_name)s/rawhide/%(arch)s/%(tree_name)s yum_baseurl = http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/%(arch)s/os/ # lorax_additional_repos = http://127.0.0.1/fedora-iot/local-overrides diff --git a/fedora-46.repo b/fedora-46.repo new file mode 100644 index 0000000..3af8c93 --- /dev/null +++ b/fedora-46.repo @@ -0,0 +1,12 @@ +[fedora-46] +name=Fedora 46 - $basearch +failovermethod=priority +#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/46/Everything/$basearch/os/ +metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-46&arch=$basearch +enabled=1 +#metadata_expire=7d +repo_gpgcheck=0 +type=rpm +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-46-$basearch +skip_if_unavailable=False diff --git a/fedora-iot-base.yaml b/fedora-iot-base.yaml index f15f5e3..79160b5 100644 --- a/fedora-iot-base.yaml +++ b/fedora-iot-base.yaml @@ -10,8 +10,8 @@ selinux: true tmp-is-dir: true recommends: false documentation: false -automatic_version_prefix: '45' -mutate-os-release: '45' +automatic_version_prefix: '46' +mutate-os-release: '46' initramfs-args: - "--no-hostonly" - "--add" diff --git a/fedora-iot.yaml b/fedora-iot.yaml index 4e3caeb..b770dff 100644 --- a/fedora-iot.yaml +++ b/fedora-iot.yaml @@ -2,4 +2,4 @@ include: fedora-iot-base.yaml ref: fedora/rawhide/${basearch}/iot repos: -- fedora-45 +- fedora-46 From 87eaa6a42bd33968869d8f4a1cf9ef596e3ce74b Mon Sep 17 00:00:00 2001 From: Paul Whalen Date: Mon, 17 Aug 2026 14:41:53 -0400 Subject: [PATCH 44/44] Update gpgkey path in fedora-46.repo, drop unused fedora-45.repo Update gpgkey path in fedora-46.repo from /etc/pki/rpm-gpg/ to /usr/share/pki/rpm-gpg/ for the F45 GPG key relocation. See: https://discussion.fedoraproject.org/t/f45-change-proposal-relocate-rpm-repo-configs-to-usr-selfcontained/188916 Remove fedora-45.repo from main (rawhide) - it belongs on f45-branch. Assisted-by: Claude Opus 4.6 Signed-off-by: Paul Whalen --- fedora-45.repo | 12 ------------ fedora-46.repo | 2 +- 2 files changed, 1 insertion(+), 13 deletions(-) delete mode 100644 fedora-45.repo diff --git a/fedora-45.repo b/fedora-45.repo deleted file mode 100644 index 85e6dd9..0000000 --- a/fedora-45.repo +++ /dev/null @@ -1,12 +0,0 @@ -[fedora-45] -name=Fedora 45 - $basearch -failovermethod=priority -#baseurl=http://download.fedoraproject.org/pub/fedora/linux/releases/45/Everything/$basearch/os/ -metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-45&arch=$basearch -enabled=1 -#metadata_expire=7d -repo_gpgcheck=0 -type=rpm -gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-45-$basearch -skip_if_unavailable=False diff --git a/fedora-46.repo b/fedora-46.repo index 3af8c93..03af70c 100644 --- a/fedora-46.repo +++ b/fedora-46.repo @@ -8,5 +8,5 @@ enabled=1 repo_gpgcheck=0 type=rpm gpgcheck=1 -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-46-$basearch +gpgkey=file:///usr/share/pki/rpm-gpg/RPM-GPG-KEY-fedora-46-$basearch skip_if_unavailable=False